<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>只有一个公网IP也可以使用LVS的DR模式！(外带php session粘滞问题解决） | 失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		<article>
	
		<h1>只有一个公网IP也可以使用LVS的DR模式！(外带php session粘滞问题解决）</h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/%E5%8F%AA%E6%9C%89%E4%B8%80%E4%B8%AA%E5%85%AC%E7%BD%91IP%E4%B9%9F%E5%8F%AF%E4%BB%A5%E4%BD%BF%E7%94%A8LVS%E7%9A%84DR%E6%A8%A1%E5%BC%8F/01.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;单个公网ip怎么才能使用LVS的DR模式？倒不是因为没有公网IP，而是由于安全性的考虑不希望服务器都暴漏在外，又不想因为这个小项目买防火墙，所以就提了这个要求。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;怎么样才能实现呢？一个公网IP也可以做DR啊，前面加个路由器就可以了</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;具体结构就想上面那个图那样</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;原理就是让 路由器把所有的80端口请求都分给VIP，分发器再分给每个web服务器，而web服务器处理完请求后跟客户连接就不走分发器了，直接通过路由器去外网了，这样就实现了只用一个公网IP也能用DR模式，呵呵 具体配置如下</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;先从内网找了三台服务器分别是：</p>
<ul>
<li>192.168.1.166 web1</li>
<li>192.168.1.167 web2</li>
<li>192.168.1.160 分发器</li>
<li>192.168.1.169 VIP</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;192.168.1.1   路由器内网ip(网关) 路由器是随便找的一台tplink adal路由器，凑合着测试用的</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;211.83.113.119 路由器的WAN口IP </p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;先安装ipvsadm 直接yum install ipvsadm就行了</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;用的是keepalived，配置文件贴上来，以下是分发器上的设置</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div><div class="line">53</div><div class="line">54</div><div class="line">55</div><div class="line">56</div><div class="line">57</div><div class="line">58</div></pre></td><td class="code"><pre><div class="line">global_defs &#123;</div><div class="line">   notification_email &#123;</div><div class="line">        ufo@xman.com</div><div class="line">   &#125;</div><div class="line"></div><div class="line">notification_email_from Alexandre.Cassen@firewall.loc</div><div class="line">   smtp_server smtp.qq.com</div><div class="line">   smtp_connect_timeout 30</div><div class="line">   router_id LVS_DEVEL</div><div class="line">&#125;</div><div class="line"></div><div class="line">vrrp_sync_group VG1 &#123;</div><div class="line">        group&#123;</div><div class="line">        VI_1</div><div class="line">                &#125;</div><div class="line">                    &#125;</div><div class="line">vrrp_instance VI_1 &#123;</div><div class="line">        state MASTER</div><div class="line">        interface eth0</div><div class="line">        virtual_router_id 51</div><div class="line">        priority 100</div><div class="line">        advert_int 1</div><div class="line"></div><div class="line">        authentication &#123;</div><div class="line">        auth_type PASS</div><div class="line">        auth_pass 33210</div><div class="line">                        &#125;</div><div class="line"></div><div class="line">        virtual_ipaddress &#123;</div><div class="line">        192.168.1.169</div><div class="line">                          &#125;</div><div class="line"></div><div class="line">        virtual_server 192.168.1.169 80 &#123;</div><div class="line">        delay_loop 6</div><div class="line">        lb_algo rr</div><div class="line">        lb_kind DR</div><div class="line">        protocol TCP</div><div class="line"></div><div class="line">                real_server 192.168.1.166 80 &#123;</div><div class="line">                weight 1</div><div class="line">                inhibit_on_failure</div><div class="line">                TCP_CHECK &#123;</div><div class="line">                connect_timeout 5</div><div class="line">                nb_get_retry 3</div><div class="line">                delay_before_retry 3</div><div class="line">                connect_port 80</div><div class="line">                          &#125;</div><div class="line">                                              &#125;</div><div class="line">                real_server 192.168.1.167 80 &#123;</div><div class="line">                weight 1</div><div class="line">                inhibit_on_failure</div><div class="line">                TCP_CHECK &#123;</div><div class="line">                connect_timeout 5</div><div class="line">                nb_get_retry 3</div><div class="line">                delay_before_retry 3</div><div class="line">                connect_port 80</div><div class="line">                          &#125;</div><div class="line">                                              &#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;配置文件写完了，然后就是</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">mkdir /etc/keepalived  <span class="comment">#系统默认会到这里去找配置文件</span></div><div class="line">cp /usr/<span class="built_in">local</span>/keepalive/etc/keepalived/keepalived.conf /etc/keepalived/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalive/etc/rc.d/init.d/keepalived /etc/init.d/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalive/etc/sysconfig/keepalived /etc/sysconfig/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalive/sbin/keepalived /bin/ <span class="comment">#将可执行程序放入sbin 或者 bin目录里</span></div></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">vim /etc/sysctl.conf</div><div class="line"></div><div class="line">net.ipv4.ip_forward = 1</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;保存退出 后执行</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">sysctl -p</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;route add defaule gw 192.168.1.1 把路由内网地址添加为默认网关</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>web服务器设置</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;两台web服务器也要修改 /etc/sysctl.conf 修改内容如下</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div></pre></td><td class="code"><pre><div class="line">vim /etc/sysctl.conf</div><div class="line"><span class="comment"># LVS</span></div><div class="line">net.ipv4.conf.all.arp_ignore = 1</div><div class="line">net.ipv4.conf.all.arp_announce = 2</div><div class="line">net.ipv4.conf.lo.arp_ignore = 1</div><div class="line">net.ipv4.conf.lo.arp_announce = 2</div><div class="line">sysctl -p</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;之后还要增加vip</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ifconfig lo:1 192.168.1.169 netmask 255.255.255.255 别忘了加到rc.local里面</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;route add defaule gw 192.168.1.1 把路由内网地址添加为默认网关</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>路由器设置</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;路由器的设置没什么好说的，除了上网设置以外还要做一个端口映射，就是把80端口映射到 vip上也就是192.168.1.169</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;现在启动keepalived吧</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">/etc/init.d/keepalived start</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;开始的时候比较慢，大概1分钟后系统日志里面出现下面这条记录就OK了</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">avahi-daemon[3012]: Registering new address record <span class="keyword">for</span> 192.168.1.169 on eth0</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;访问一下 <a href="http://211.83.113.119" target="_blank" rel="external">http://211.83.113.119</a> 成功了 </p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div></pre></td><td class="code"><pre><div class="line">ipvsadm -L -n</div><div class="line">IP Virtual Server version 1.2.1 (size=4096)</div><div class="line">Prot LocalAddress:Port Scheduler Flags</div><div class="line">  -&gt; RemoteAddress:Port           Forward Weight ActiveConn InActConn</div><div class="line">TCP  192.168.1.169:80 rr</div><div class="line">  -&gt; 192.168.1.166:80             Route   1      5          6         </div><div class="line">  -&gt; 192.168.1.167:80             Route   1      3          9</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;后来遇到了一个问题，由于这套应用处在一个大网站的后台，所以大部分的请求都来自同一个IP地址，而有一部分程序需要给每个连接做session粘滞，</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这样就不能用lvs 的-p参数来设置ip粘滞时间，如果用lvs的粘滞时间的话大部分的请求都将分给同一台web服务器(注意：这里是session粘滞而不是IP粘滞)，</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;lvs可做不到这点，怎么办呢？</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;解决办法是 将session共享，共享到什么地方就有很多选择了</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这里是把所有web服务器的php session都给memcached ，这样不管分发器把 ip连接分给哪个web服务器都不会有问题了，配置方法很简单，就在php的配置文件内</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;增加一条语句就可以了，不过前提需要装好memcache模块</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">[Session]</div><div class="line">; Handler used to store/retrieve data.</div><div class="line">session.save_handler = memcache</div><div class="line">session.save_path = <span class="string">"tcp://192.168.1.161:11213"</span></div></pre></td></tr></table></figure>

	

	
		<span class="different-posts"><a href="/2017/10/12/LVS/18. 只有一个公网IP也可以使用LVS的DR模式！(外带php session粘滞问题解决）/" onclick="window.history.go(-1); return false;">⬅️ Go back </a></span>

	

</article>

	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
